Chapter 4 — Routing & HTTP Methods

The why

Routing is matching a URL + method to a function. Do it cleanly and the rest of your API is easy. Do it messily and every new endpoint becomes a fight.

Express in 10 lines

Install Express:

npm install express

Write a server:

const express = require('express');
const app = express();
 
app.use(express.json()); // parse JSON bodies
 
app.get('/', (req, res) => res.send('Hello'));
app.get('/users', (req, res) => res.json([{ id: 1, name: 'Aditi' }]));
app.post('/users', (req, res) => res.status(201).json({ ...req.body, id: 2 }));
 
app.listen(3000, () => console.log('http://localhost:3000'));

Compare to the vanilla HTTP server from chapter 3 — this is half the code and does more.

The routing primitives

Five things to know:

1. Static paths

app.get('/about', handler);
app.post('/login', handler);

Exact match.

2. Route params (path variables)

app.get('/users/:id', (req, res) => {
  res.json({ userId: req.params.id });
});

:id is captured into req.params. You can have several: /users/:userId/posts/:postId.

Tip: route params are always strings. Cast to number / UUID-validate if needed.

3. Query strings

// GET /search?q=node&limit=10
app.get('/search', (req, res) => {
  const { q, limit } = req.query;
  res.json({ q,

Anything after ? is parsed into req.query. Strings by default.

4. Wildcards (use sparingly)

app.get('/files/*', handler);  // matches /files/anything/here

Useful for proxies, static file servers. Don't use in regular routing.

5. The catch-all

app.use((req, res) => res.status(404).json({ error: 'Not found' }));

Goes last. Catches anything that didn't match.

HTTP methods — when to use which

We covered the semantics in L0 chapter 3. Quick recap as it applies to Express:

app.get('/users',          listUsers);     // read all
app.get('/users/:id',      getUser);       // read one
app.post('/users',         createUser)

Common newbie mistake: using POST for everything. Don't. The method conveys intent, drives caching behavior, and matters for security (CSRF defenses key off it).

req.params vs req.query vs req.body

Three places data comes from. Get them mixed up and you'll spend hours.

// POST /users/42/posts?notify=true
// Body: {"title": "Hello"}
 
app.post('/users/:id/posts', (req, res) => {
  console.log(req.params.id);   //

That 'true' is a string trap. Always cast/validate.

Routers — keeping it organized

Putting every route in app.js works for 10 endpoints. After 50, it's a 2000-line file.

Use routers to split by resource:

const router = require('express').Router();
 
router.get('/',     listUsers);
router.get('/:id',  getUser);
router.post

const usersRouter = require('./routes/users');
const postsRouter = require('./routes/posts');
 
app.use('/api/users', usersRouter);
app.use('/api/posts'

GET /api/users/42 now routes to getUser cleanly.

You can nest routers. Don't go more than 2 levels deep — at 3+, your URL design is probably wrong.

Order matters — the #1 gotcha

Express tries routes in the order they're defined. First match wins.

// Wrong order:
app.get('/users/:id',  getUser);
app.get('/users/me',   getMe);   // never runs!

Why? '/users/me' matches /users/:id first (with id = 'me'). The me route is unreachable.

Fix: put specific routes before generic ones.

// Right order:
app.get('/users/me',  getMe);
app.get('/users/:id', getUser);

The three common gotchas

1. Trailing slashes. /users and /users/ are different URLs. Express by default treats them as the same in routing but the difference matters in Location headers, redirects, and CDN caching. Pick one (no trailing slash) and enforce it.

2. Encoding. /search?q=hello%20world arrives as req.query.q === 'hello world' — Express decodes for you. Don't decode again.

3. Case sensitivity. Express is case-sensitive on routes. /Users ≠ /users. Normalize at the edge (nginx lowercase) if your users won't.

Multiple handlers — middleware preview

You can chain handlers on one route:

app.get('/users/:id', requireAuth, loadUser, sendUser);

Each one runs in order. Each one can next() to the next, or send a response. We'll spend all of next chapter on this.

Common mistakes

Production · Performance · Security notes

Production. Define a single 404 handler at the end. Don't let unknown paths get away with default HTML errors.

Performance. Express routing is already fast for hundreds of routes. Don't micro-optimize. If you need extreme speed, look at Fastify.

Security. Validate req.params.id shape (UUID? integer?) before using it in a DB query. Path traversal (/users/../../admin) is real if you naively concat paths.

Exercises

1. Beginner. Build an Express app with CRUD on /api/items — in-memory array, no DB.
2. Beginner. Add a /health endpoint.
3. Intermediate. Split routes into two routers (items, users). Mount them under /api.
4. Intermediate. Add ?limit=&cursor= pagination to GET /api/items.
5. Advanced. Add a wildcard 404 handler that logs the missed URL.

Interview questions

Beginner. What's the difference between req.params and req.query? params come from path; query comes from URL search string. Both are strings.

Senior. Walk me through your folder structure for routes. Per-resource files, mounted under a versioned prefix (/api/v1), business logic in services not in routes.

Summary

Routing matches URL + method to a handler. Express gives you app.METHOD(path, handler). Use route params for identifiers, query strings for filters, body for payloads. Split routes into routers per resource. Define specific routes before generic ones. The handler chain (middleware + final handler) is the heart of Express — that's the next chapter.

Quick recall

• app.get('/users/:id', handler) — params, query, body are three different sources.
• Specific before generic. /me before /:id.
• Use a Router per resource.
• Always have a 404 catch-all.

Quiz

1. What's the difference between req.params and req.query?
2. What's wrong with app.get('/users/:id', getUser); app.get('/users/me', getMe); in this order?
3. Which HTTP method should DELETE /users/42 use? (Trick question.)
4. What does app.use('/api', router) do?
5. Why is the catch-all 404 important?